OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)

Key facts for GPT-6 Cyber Firefox flaws

Detection coverage for GPT-6 Cyber Firefox flaws

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5373 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5373 Firefox Spawning Shell or Script Interpreter (MFSA2026-118 Exploitation)

Detects the Firefox main or content process (firefox.exe, including -contentproc children) spawning cmd, PowerShell, WSH or WSL. Firefox never needs to start these interpreters in normal browsing, so a hit is a strong post-exploitation signal of a memory-corruption exploit (e.g. the use-after-free class fixed in Firefox 159, MFSA2026-118, CWE-416) reaching code execution. No in-the-wild exploitation is reported yet, so this is an n-day readiness detection for unpatched Firefox (< 159).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1189, T1059
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon earliest=-24h sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\firefox.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\bash.exe" OR Image="*\\wsl.exe")
| eval content_process=if(like(ParentCommandLine, "%-contentproc%"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_commandlines values(content_process) as spawned_by_content_process by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "firefox.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "bash.exe", "wsl.exe")
| extend ContentProcess = InitiatingProcessCommandLine has "-contentproc"
| project Timestamp, DeviceName, AccountName, ContentProcess, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Firefox Spawning Shell or Script Interpreter (TL-2026-5373)
id: 1b2c3d4e-5f60-4a71-8b92-a3b4c5d6e701
status: experimental
description: Detects firefox.exe (main or content process) spawning a command shell or script host, a strong indicator of browser exploitation such as the use-after-free flaws fixed in Firefox 159 (MFSA2026-118).
references:
  - https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/
  - https://gbhackers.com/openais-new-gpt-6-cyber-finds-81-high-severity-firefox-vulnerabilities/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial_access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  parent:
    ParentImage|endswith: '\firefox.exe'
  child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\bash.exe'
      - '\wsl.exe'
  condition: parent and child
falsepositives:
  - Browser extensions or native-messaging hosts that launch helper scripts
  - Enterprise kiosk or SSO tooling that launches scripts from Firefox
level: high

Known false positives:

• Firefox native-messaging hosts or extensions that intentionally launch helper scripts
• Enterprise kiosk, SSO or password-manager integrations that start PowerShell or cmd from Firefox

Tuning notes: Baseline for one week and allowlist known native-messaging host command lines via CommandLine exclusions. Raise priority when spawned_by_content_process=yes or when the host runs Firefox older than 159. Pair with the exposure inventory for CVEs from MFSA2026-118.

• 🔒 TL-2026-5373 Repeated [indicator] Crashes in xul.dll (Memory-Corruption Exploit Attempts) · unlock with TL Creds
• 🔒 TL-2026-5373 Discovery Commands Spawned from [indicator] (Post-Exploitation Recon) · unlock with TL Creds
• 🔒 TL-2026-5373 Firefox-Descended Process Making Outbound Public Connections (C2 Callback) · unlock with TL Creds
• 🔒 TL-2026-5373 Linux [indicator] Spawning Shell or Network Tool (Browser Exploitation) · unlock with TL Creds
• 🔒 TL-2026-5373 [indicator] Writing Run Key or Startup Folder Persistence · unlock with TL Creds
• 🔒 TL-2026-5373 [indicator] Spawning Living-off-the-Land Proxy Execution Binaries · unlock with TL Creds
• 🔒 TL-2026-5373 [indicator] Sandbox Escape or Elevated Child Process (CVE-2026-117861 / CVE-2026-117862) · unlock with TL Creds
• 🔒 TL-2026-5373 Executable or Script Dropped by [indicator] and Executed (Post-Exploit Ingress) · unlock with TL Creds

Indicators of compromise for GPT-6 Cyber Firefox flaws

As of 2026-11-06, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5373.

How GPT-6 Cyber Firefox flaws works

GBHackers (2026-11-06) reports that OpenAI's GPT-6 Cyber, a cybersecurity-specialised model distributed to vetted defenders through OpenAI's Daybreak programme, found 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity. Each finding came with evidence and reproducible tests. The model also found 30 already-known Firefox issues that proved worse than first reported. Mozilla began landing fixes soon after receiving the findings and proposed patches. The article reports no in-the-wild exploitation.

The same article cites Mozilla advisory MFSA2026-118, which Mozilla published on 2026-10-27 for Firefox 159. We fetched that advisory. It covers 126 individually numbered CVEs: 94 high, 29 moderate and 3 low impact. Most high-impact entries are use-after-free conditions in the DOM, Layout, JavaScript engine (GC), Graphics (Canvas2D), WebRTC, Audio/Video, Storage, XML and XSLT components. The advisory also lists a same-origin-policy bypass (CVE-2026-117860), a sandbox escape (CVE-2026-117861) and a privilege escalation from incorrect boundary conditions in Networking (CVE-2026-117862). Mozilla states that it changed its methodology to issue an advisory for every individual bug instead of consolidating memory-safety bugs into one CVE.

Attribution caveat: the advisory does not name GPT-6 Cyber. It credits high-impact CVEs to the reporters 'OpenAI Codex Security (kylebot)' (components include CSS parsing, WebSockets, DOM bindings/events/core, Layout, XML, SVG, JS engine and JIT) or Amy Burnett of OpenAI (Layout, IndexedDB, DOM Navigation). These are the closest sourced mapping to OpenAI-originated work, but they are not confirmed to be the 81 in the GBHackers claim, and the advisory gives no 81-finding count. Data-quality caveat: repeated fetches of the advisory returned inconsistent summary totals (126, 161 and 166 CVEs) and slightly different credited-CVE lists, so cve_list (34 IDs) is the union of the OpenAI-credited IDs seen across fetches and must be reconciled against the live advisory before detection content is derived from it. The OpenAI announcement (openai.com/index/introducing-gpt-6-cyber/) returned HTTP 403 and was not read.

Broader context from the GBHackers article: GPT-6 Cyber reportedly produced 948 Linux kernel exploits, reproduced 1,724 Linux kernel vulnerabilities and disclosed 304 critical findings to maintainers. It scored 48.5% on ExploitGym versus 32.1% for GPT-5.6 Cyber, and reportedly avoided honeypots 99.93% of the time. Access sits behind the Daybreak Red and Daybreak Blue tiers, with identity verification, SSO/MFA, FIDO2 keys and IP allowlisting. Other outlets report that OpenAI rates the model at a 'critical' cyber capability level under its Preparedness Framework. Earlier 2026 reporting describes comparable AI-assisted Firefox work by Anthropic (Claude Opus 4.6: 22 vulnerabilities, 14 high severity, fixed mostly in Firefox 148; Claude Mythos Preview: 271 vulnerabilities fixed in Firefox 150).

Defensive relevance: the main risk is faster, cheaper discovery and exploit development for memory-safety bugs in browsers and kernels, which shortens patch windows. Defenders should keep Firefox current (159 or later) and watch for post-patch n-day exploitation. No IOCs, exploit code or attacker infrastructure are published.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities

Remediation for GPT-6 Cyber Firefox flaws

Patches

• Firefox 159 (Mozilla Foundation Security Advisory 2026-118, published 2026-10-27)

Immediate actions

• Update Mozilla Firefox to version 159 or later (MFSA2026-118)
• Verify Firefox auto-update is enabled and enforced via enterprise policy
• Confirm Firefox ESR deployments received the corresponding fixes from the MFSA2026-118 advisory

Workarounds

• Restrict browsing to trusted sites on unpatched hosts until updated
• Use site isolation and the default content sandbox level

Longer-term hardening

• Shorten browser patch SLAs, since AI-assisted discovery compresses the time between patch and n-day exploit
• Maintain browser process sandboxing and exploit-mitigation settings
• Monitor Firefox child-process crashes and anomalous process spawning from firefox.exe or firefox

Affected and fixed versions

• Mozilla — Firefox
  Vulnerable versions: versions prior to 159
  Fixed in: 159

Timeline of GPT-6 Cyber Firefox flaws

• 2026-08-12 locked-ioc-15 announces locked-ioc-4 and expanded Daybreak access for vetted security researchers (Gigazine, 2026-08-12), the predecessor to locked-ioc-9.
• 2026-09-28 Press reports (Fortune, via TNW, wwwhatsnew and others) say locked-ioc-15 is preparing to preview locked-ioc-9 at DevDay on 2026-09-29. locked-ioc-15 had not confirmed it at the time.
• 2026-09-29 locked-ioc-15 DevDay in San Francisco, the reported venue for the locked-ioc-9 preview.
• 2026-10-27 MFSA2026-118 states locked-ioc-12 no longer rolls internally identified memory-safety bugs into a single CVE and now issues an advisory for every individual bug, which is why the advisory lists a very large number of CVEs.
• 2026-10-27 locked-ioc-12 publishes MFSA2026-118 with locked-ioc-14 159, covering 126 individually numbered CVEs (94 high, 29 moderate, 3 low). 16 high-impact CVEs are credited to locked-ioc-15 locked-ioc-3 (locked-ioc-13) or locked-ioc-8 of locked-ioc-15.
• 2026-11-06 GBHackers also reports locked-ioc-9 reproduced 1,724 Linux kernel vulnerabilities, developed 948 working exploits and disclosed 304 critical findings, scored 48.5% on locked-ioc-11 (locked-ioc-4: 32.1%) and is rated Critical under locked-ioc-15's Preparedness Framework (locked-ioc-4: High).
• 2026-11-06 GBHackers reports that locked-ioc-9 found 81 previously unknown locked-ioc-14 flaws that locked-ioc-12 rated high severity, plus 30 known issues that were worse than reported. It reports no in-the-wild exploitation.

Sources cited for GPT-6 Cyber Firefox flaws

• Mozilla Foundation Security Advisory 2026-118 (Firefox 159) mozilla.org · Vendor report · 2026-10-27
• Introducing GPT-6 Cyber (OpenAI; cited by GBHackers, HTTP 403 on fetch) openai.com · Vendor report
• OpenAI's New GPT-6 Cyber Finds 81 High-Severity Firefox Vulnerabilities and 948 Linux Kernel Exploits gbhackers.com · News · 2026-11-06
• OpenAI prepara GPT-6 Cyber para el DevDay del 29 de septiembre wwwhatsnew.com · News · 2026-09-28
• OpenAI lleva GPT-6 Cyber a DevDay: defensa con IA ecosistemastartup.com · News · 2026-09-28
• OpenAI GPT-5.6 Cyber announcement and Daybreak access (Gigazine) gigazine.net · News · 2026-08-12
• OpenAI is reportedly preparing to preview a GPT-6 Cyber security model thenextweb.com · News
• Anthropic says it found a heap of Firefox security flaws using new Claude tools (context) techradar.com · News

More in vulnerability

• Multi-vendor vulnerability roundup: Node2Shell Brotli RCE (CVE-2026-111497, actively exploited, CISA KEV), WatchGuard CVE-2026-98432 (CVSS 9.8) and AuthPoint Gateway flaws, Cisco UCS Central CVE-2026-76506, SonicWall GMS CVE-2026-109593/109594 unpatched (EOL)
• Claude Dispatch "ThisBash" flaw lets malicious browser extensions drive Claude Desktop to execute commands locally or on other machines on the same account; Anthropic has not fixed it
• Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)
• Marimo CVE-2026-39987: unauthenticated /terminal/ws RCE exploited to harvest AWS credentials and pivot to an SSH bastion in 8 seconds
• Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers